CVE-2026-26133

• Microsoft/365 Copilot2 versions

  cpe:2.3:a:microsoft:365_copilot:*:*:*:*:*:android:*:*+ 1 more

  • cpe:2.3:a:microsoft:365_copilot:*:*:*:*:*:android:*:*range: <16.0.19815.10000
  • cpe:2.3:a:microsoft:365_copilot:*:*:*:*:*:iphone_os:*:*range: <2.107.2
• Microsoft/Edge2 versions

  cpe:2.3:a:microsoft:edge:*:*:*:*:*:android:*:*+ 1 more

  • cpe:2.3:a:microsoft:edge:*:*:*:*:*:android:*:*range: <145.3800.99
  • cpe:2.3:a:microsoft:edge:*:*:*:*:*:iphone_os:*:*range: <145.3800.99
• Microsoft/Excel2 versions

  cpe:2.3:a:microsoft:excel:*:*:*:*:*:android:*:*+ 1 more

  • cpe:2.3:a:microsoft:excel:*:*:*:*:*:android:*:*range: <16.0.19822.20038
  • cpe:2.3:a:microsoft:excel:*:*:*:*:*:iphone_os:*:*range: <2.106.2
• Microsoft/Loop

  cpe:2.3:a:microsoft:loop:*:*:*:*:*:iphone_os:*:*

  Range: <2.106
• Microsoft/Onenote2 versions

  cpe:2.3:a:microsoft:onenote:*:*:*:*:*:android:*:*+ 1 more

  • cpe:2.3:a:microsoft:onenote:*:*:*:*:*:android:*:*range: <16.0.19725.20142
  • cpe:2.3:a:microsoft:onenote:-:*:*:*:*:iphone_os:*:*
• Microsoft/Outlook3 versions

  cpe:2.3:a:microsoft:outlook:*:*:*:*:*:android:*:*+ 2 more

  • cpe:2.3:a:microsoft:outlook:*:*:*:*:*:android:*:*range: <5.2605.0
  • cpe:2.3:a:microsoft:outlook:*:*:*:*:*:iphone_os:*:*range: <5.2605.0
  • cpe:2.3:a:microsoft:outlook:-:*:*:*:*:macos:*:*
• Microsoft/Power Bi2 versions

  cpe:2.3:a:microsoft:power_bi:*:*:*:*:*:android:*:*+ 1 more

  • cpe:2.3:a:microsoft:power_bi:*:*:*:*:*:android:*:*range: <2.2.260210.21290750
  • cpe:2.3:a:microsoft:power_bi:-:*:*:*:*:iphone_os:*:*
• Microsoft/Powerpoint2 versions

  cpe:2.3:a:microsoft:powerpoint:*:*:*:*:*:android:*:*+ 1 more

  • cpe:2.3:a:microsoft:powerpoint:*:*:*:*:*:android:*:*range: <16.0.19822.20038
  • cpe:2.3:a:microsoft:powerpoint:*:*:*:*:*:iphone_os:*:*range: <2.106.2
• Microsoft/Teams2 versions

  cpe:2.3:a:microsoft:teams:*:*:*:*:*:android:*:*+ 1 more

  • cpe:2.3:a:microsoft:teams:*:*:*:*:*:android:*:*range: <1.0.0.2026043102
  • cpe:2.3:a:microsoft:teams:*:*:*:*:*:iphone_os:*:*range: <8.3.1
• Microsoft/Word2 versions

  cpe:2.3:a:microsoft:word:*:*:*:*:*:android:*:*+ 1 more

  • cpe:2.3:a:microsoft:word:*:*:*:*:*:android:*:*range: <16.0.19822.20038
  • cpe:2.3:a:microsoft:word:*:*:*:*:*:iphone_os:*:*range: <2.106.2

No patches discovered yet.

AI mechanics synthesis has not run for this CVE yet.

• msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26133nvdVendor Advisory

• Microsoft warns of Exchange zero-day flaw exploited in attacks
  BleepingComputer · May 15, 2026
• Simple bypass of the link preview function in Outlook Junk folder, (Thu, May 14th)
  SANS Internet Storm Center · May 14, 2026
• AWS to Quick admins: The access control didn't work, but you weren't using it anyway, so what's the problem?
  The Register Security · May 13, 2026
• Microsoft Patches Critical Zero-Click Outlook Vulnerability Threatening Enterprises
  SecurityWeek · May 13, 2026
• Microsoft May 2026 Patch Tuesday, (Tue, May 12th)
  SANS Internet Storm Center · May 12, 2026
• TCLBANKER Banking Trojan Targets Financial Platforms via WhatsApp and Outlook Worms
  The Hacker News · May 8, 2026
• Why the approaching flood of vulnerabilities changes everything — and what to do about it
  Tenable Blog · May 8, 2026
• New TCLBanker malware self-spreads over WhatsApp and Outlook
  BleepingComputer · May 7, 2026
• VECT: Ransomware by design, Wiper by accident
  Check Point Research · Apr 28, 2026
• Chinese APT Abuses Multiple Cloud Tools to Spy on Mongolia
  Dark Reading · Apr 24, 2026
• IR Trends Q1 2026: Phishing reemerges as top initial access vector, as attacks targeting public administration persist
  Cisco Talos Intelligence · Apr 22, 2026
• DFIR Report – The Gentlemen & SystemBC: A Sneak Peek Behind the Proxy
  Check Point Research · Apr 20, 2026
• More than pretty pictures: Wendy Bishop on visual storytelling in tech
  Cisco Talos Intelligence · Apr 16, 2026
• The n8n n8mare: How threat actors are misusing AI workflow automation
  Cisco Talos Intelligence · Apr 15, 2026
• Patch Tuesday - April 2026
  Rapid7 Blog · Apr 14, 2026
• Russia Hacked Routers to Steal Microsoft Office Tokens
  Krebs on Security · Apr 7, 2026
• Iran-Backed Hackers Claim Wiper Attack on Medtech Firm Stryker
  Krebs on Security · Mar 11, 2026